Hands-on Exploitation Certification

Question 1

What is an Open Redirects?

Answer 1

Open redirects happen when the web application takes an untrusted input and redirects a user from the web application to untrusted site or resources that will be used further for malicious purposes

Question 2

What is the threat level of an open redirects?

Answer 2

Low

Question 3

What does XSS stand for?

Answer 3

Cross site scripting

Question 4

What should you be looking for to evaluate for XSS?

Answer 4

Anywhere You can inject an input

Question 5

What type of threat is the following?

Www.meow.com/?name=<meowscript>alert(one)</meowscript>

Answer 5

XSS

Question 6

What is stored XSS?

Answer 6

Stored XSS is when the script is stored on the application database. For instance a comment section. If you are able to to set an alert as a script on there then everyone that visits would get the alert

Question 7

What is Blind XSS

Answer 7

Blind XSS is where the payload is fired on an internal system that is only accessed by employees.

Question 8

What language are XSS payloads written in?

Answer 8

Javascript

Question 9

What common method/function is used to test for the existence of XSS?

Answer 9

alert

Question 10

What type of XSS can achieve persistance on an app?

Answer 10

Stored

Question 11

What type of XSS do you receive no immediate feedback for whether is has worked of not?

Answer 11

Blind

Question 12

In more modern Chrome browsers alert() may not work in iframe payloads. What method can you use instead?

Answer 12

print()

Question 13

What is Reflected XSS?

Answer 13

where the malicious script comes from the current HTTP request.

Question 14

What is DOM-based XSS?

Answer 14

where the vulnerability exists in client-side code rather than server-side code.

Question 15

What are six things XSS can be used for?

Answer 15

1. Impersonate or masquerade as the victim user.
2. Carry out any action that the user is able to perform.
3. Read any data that the user is able to access.
4. Capture the user’s login credentials.
5. Perform virtual defacement of the web site.
6. Inject trojan functionality into the web site.

Question 16

What does CSP stand for?

Answer 16

Content Security Policy

Question 17

In Chrome Dev Tools where can you find CSP data?

Answer 17

In network it will be in one of the files that looks like a little blue document

Question 18

XSS:
How can you get around this to make the alert fire off?

Answer 18

by including “> this will close off the value tag causing the alert to fire

Question 19

What are you looking for on a web app to try CSRF?

Answer 19

It is a web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to perform. It allows an attacker to partly circumvent the same origin policy, which is designed to prevent different websites from interfering with each other.

Question 20

What is Cross Site Request forgery

Question 22

XSS:
How can you escape this text area to fire off this alert?

Answer 22

By closing off the text area like so </textarea>

Since everything inside the test area is considered raw text the script wont fire

Question 23

XSS:
How can you escape this title field to fire off this alert?

Answer 23

By closing the title tag like so </title> this will close the html and fire off the alert

Question 24

XSS:
How can we insert an alert for this for that injects a style element into the header?

Answer 24

By closing off the stylle tag

Question 25

XSS:
How would we want to handle this alert we injected to cause it to fire?

Answer 25

The value we place get put into a string. to close the value we will want to start with closing the string with ‘

once we close the string we qwill want to end the variable declaration with ; once that is closed our alert will then be in order. However the program will auto add another ; so we will want to comment out the rest of the line with //

Question 26

When looking for a XSS vulnerability if you don’t see your payload come back in in the browser inspection what should you do?

Answer 26

use a tool like Burpsuite or Caido to intercept the request. Chances are its calling to an API and you can test from there.